[Closed] red X over C and thousands of pos temp

i know there are a ton of these out there, but i have my log file for you to look over, so here ya go! Malwarebytes' Anti-Malware 1.05 Database version: 419 Scan type: Quick Scan Objects scanned: 50081 Time elapsed: 23 minute(s), 49 second(s) Memory Processes Infected: 0 Memory Modules Infected: 5 Registry Keys Infected: 19 Registry Values Infected: 3 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 15 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: C:\WINDOWS\system32\gnaobyee.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\ujppsubc.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\ukovfkbe.dll (Trojan.Vundo) -> Unloaded module successfully. C:\Documents and Settings\Denman\Local Settings\Temp\geede.dll (Trojan.Vundo) -> Unloaded module successfully. C:\WINDOWS\system32\geede.dll (Trojan.Vundo) -> Unloaded module successfully. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1766b5a2-3ccb-45f5-92c8-b4b61d5b5593} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{1766b5a2-3ccb-45f5-92c8-b4b61d5b5593} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a95b2816-1d7e-4561-a202-68c0de02353a} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{a95b2816-1d7e-4561-a202-68c0de02353a} (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{11a69ae4-fbed-4832-a2bf-45af82825583} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ujppsubc (Trojan.Vundo) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{24c61c09-62c0-42ed-b640-53f7fec9098a} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24c61c09-62c0-42ed-b640-53f7fec9098a} (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\geede (Trojan.Vundo) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\aldd (Malware.Trace) -> Delete on reboot. HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{24c61c09-62c0-42ed-b640-53f7fec9098a} (Trojan.Vundo) -> Delete on reboot. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSServer (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmds (Malware.Trace) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\docume~1\denman\locals~1\temp\geede -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\bfpqbjrk.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\krjbqpfb.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\fsblhans.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\snahlbsf.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\gnaobyee.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\eeyboang.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ujppsubc.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\ujppsubc.dllbox (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ukovfkbe.dll (Trojan.Vundo) -> Delete on reboot. C:\WINDOWS\system32\ebkfvoku.ini (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Documents and Settings\Denman\Local Settings\Temp\geede.dll (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Denman\Local Settings\Temp\edeeg.ini (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Denman\Local Settings\Temp\edeeg.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully. C:\WINDOWS\system32\geede.dll (Trojan.Vundo) -> Delete on reboot. C:\Documents and Settings\Children\Local Settings\Temp\YazzleBundle-1281.exe (Heuristic.Malware) -> Quarantined and deleted successfully.

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.


Install HijackThis

• Download HJTInstall.exe to your Desktop.
• Doubleclick HJTInstall.exe to install it.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
• Copy/Paste the log to your next reply please.

Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log